FAYETTEVILLE, Ark. (KNWA/KFTA) — Testimony concluded in the Josh Duggar child pornography trial on the afternoon of December 7 at the Western District of Arkansas federal courthouse in Fayetteville.
The defense called just two witnesses, and the prosecution responded with a single rebuttal witness.
After an extended lunch recess in order for the court to address some business, defense attorney Justin Gelfand continued his examination of digital forensics expert Michele Bush.
He picked up with questions about a photograph of the HP screen with a reflection visible in it. The picture was found on an iPhone backup on Duggar’s personal Macbook Pro laptop.
“Just because the phone exists doesn’t mean the phone took it,” she asserted, noting that the image could have been received in a text message or by other means.
She also discussed the “serious limitations” that come with the “manual triage” process of examining devices during a search, as opposed to seizing them for further investigation.
She said examining a device in the field is “like any normal user would look at it.”
On redirect, prosecutor William Clayman chose to ask questions about the reflection photo as well.
“You don’t know at all, do you?” he asked, referring to whether the image was taken by an iPhone 8.
He followed with several more questions about things the witness didn’t know or couldn’t confirm. She never looked at any employee records, and she “didn’t know if there was any actual activity in the date range” with regards to the Frazer car sales software during the relevant dates in May, 2019.
She also admitted having “no idea” if the streamed videos were only watched locally or elsewhere.
The distinction between files being deleted or never existing was a point of contention during further questioning, with Bush testifying that logs that would have indicated remote access could have been overwritten by the time of her examination.
Clayman noted that those kind of files may just never have existed at all.
For the defense’s second and final witness, they called Daniel Wilcox, a former Homeland Security Investigations task force member and Rogers Police Department narcotics officer.
Wilcox was part of the team sent on the aborted search warrant execution at the property adjacent to Duggar’s car lot.
He was also sent into Wholesale Motorcars undercover to verify that Duggar worked there. He made two visits, posing as a potential buyer. He observed a computer and an iPhone at the business.
He was not part of the actual search warrant executed at the lot, and had little knowledge about it.
“I didn’t know what their plan was,” he said.
His testimony was brief, and the cross-examination by prosecuting attorney Dustin Roberts was even shorter. All he had Wilcox attest to was knowing that the first search warrant location was targeted for Duggar’s IP address, and that his undercover assignment was simply to verify that Duggar was present at the car lot.
With that, the defense rested their case shortly before 2 p.m. There was then a substantial sidebar, which continued in the judge’s chambers.
The prosecution then called computer forensics expert James Fottrell as a rebuttal witness, specifically to respond to some of Bush’s testimony.
Fottrell testified that he had watched Bush’s time on the stand and viewed her print screen exhibits. As Bush did, Fottrell provided some “demonstrative exhibits” to the jury, detailing the simple process of downloading and installing a Linux partition.
He demonstrated that downloading a Tor browser and a VLC media player was just as easy.
As for the copy stream URL that the defense presented as complicated, Fottrell showed that it was as simple as cutting and pasting a short web address.
He also addressed the HP computer’s port numbers, which the defense expert painted as a serious security flaw.
“Every program that needs to communicate has a port number,” he explained. “It just means that that’s a port configured for the software to use.”
He concluded by stating that there was no evidence of remote access of the HP.
Gelfand and Clayman each took subsequent turns of re-direct questioning with Fottrell.
Gelfand harped on the fact that the witness’ demonstrative exhibits were constructed so recently. The defense attorney also questioned the validity of Fottrell’s examples of downloading.
The build numbers of the applications he downloaded are different now, compared to May, 2019.
“This software literally didn’t exist,” said Gelfand of the newer version.
Meanwhile, Fottrell questioned some of Bush’s methods in the same vein.
“I didn’t really understand that completely,” he said of her using archive.org to try to re-create the state of the Linux app store on a past date. “That’s not how I did my research.”
Clayman concluded the testimony portion of the trial by having their computer forensic expert reiterate several of the points the prosecution has made from the start:
- The HP user did not need to use command lines at all to install any of the applications involved.
- There was no evidence that the computer was accessed remotely on the dates in May, 2019.
- Someone was physically present behind the keyboard of the HP, downloading files on the computer.
With testimony complete, Judge Timothy L. Brooks called a recess for the day at 4:17 p.m.
He gave the jurors the nightly reminder of their responsibilities, then explained that he will provide them complete legal instructions for the trial December 8. After that, each side will deliver their closing arguments.
The jury is expected to receive the case and begin making their deliberations on December 8.
Before the gallery adjourned, KNWA/FOX24 spoke to Jim Bob Duggar, the defendant’s father, asking him about his thoughts on the day’s testimony.
“We just want the truth to come out,” he said. “And we appreciate your prayers for our family.”